The TCP output processor has paused the data flow due to issues with SSL certificates

Available Languages

Updated:September 30, 2026
Document ID:SPLK050407

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Universal Forwarder

Description

After setting up a Universal Forwarder and configuring the connection to Splunk Cloud, there is no data flowing from the Forwarder.

Investigation

1. Confirm that Cloud is not ingesting data from this Universal Forwarder. This can be done by running the following search query on the Search Head.
  
index="_internal" sourcetype="splunkd" "hostname" | stats count by hostname

If the search does not show any results, there is no data being ingested from the instance "hostname"

2. Request a diagnostic file or diag from "hostname".

3. The diag  will show warnings and errors from the components SSLCommon, X509Verify, and TcpOutputFd similar to the following:
  
03-31-2023 09:06:28.928 -0400 WARN  SSLCommon [4740 TcpOutEloop] - Received fatal SSL3 alert. ssl_state='error', alert_description='unknown CA'.03-31-2023 09:06:28.928 -0400 ERROR TcpOutputFd [4740 TcpOutEloop] - Connection to host=XX.XXX.XXX.XXX:9997 failed. sock_error = 0. SSL Error = error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name.03-31-2023 09:06:28.928 -0400 ERROR X509Verify [4740 TcpOutEloop] - Server  X509 certificate (CN=Root CA) failed validation; error=19, reason="self signed certificate in certificate chain"

image.png


4. Check the certificates on $SPLUNK_HOME/etc/apps/100_(stackID)_splunkcloud/default using openssl commands to verify the integrity and expiration date of the certificates.
  
$SPLUNK_HOME\bin\splunk cmd openssl x509 -in <.pem file> -noout -text

Where <.pem file> is the absolute path of the certificate to review.

Resolution

Download and reinstall the Universal Forwarder Credential package. For more information on how to install and configure the Credential package, see the Related Links.
Install and configure the Splunk Cloud Platform universal forwarder credentials package
 

Revision History

Revision Publish Date Comments
1.0
30-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles